This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-41137.
ZDI-26-365: FlowiseAI Flowise CSV Agent customReadCSV Code Injection Remote Code Execution Vulnerability
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2026-06-24 05:00 UTC
- Importiert: 2026-08-13 13:09 UTC
- CVSS: 9.4
- Quelle-ID:
zdi_pub - uid_hash:
536a92055ec90acb9e16f775df63eaa7264137114e87b4290be72c4471a4242a
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
CRITICAL |
9.4 |
CRITICAL |
9.4 |
2026-04-23 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| Zero Day Initiative (Published) | threat_intel | - | de | https://www.zerodayinitiative.com/rss/published/ |